2814 Commits

Author SHA1 Message Date
Dongjia "toka" Zhang
4562f19bdc
Qemu ctrl c exit (#2147)
* fix

* ignore

* fix

* aaa

* bbb
2024-05-06 15:42:43 +02:00
0393f18a47 add stg edge feedback 2024-05-06 14:46:35 +02:00
Dongjia "toka" Zhang
b0d592dc3a
Add to how to leave tui screen (#2146) 2024-05-05 17:21:15 +02:00
Dongjia "toka" Zhang
d4ff7b86b1
Add windows test & ci & fix (#2144)
* fix

* ignore

* fmt

* a
2024-05-05 14:53:27 +02:00
Dongjia "toka" Zhang
502929d967
Separate map observers (#2143)
* rename

* rename

* fmt

* fix

* fmt

* separate observers

* doc fx
2024-05-04 23:11:00 +02:00
Dongjia "toka" Zhang
b0ac25a7b5
Rename Reference to Handle (#2142)
* rename

* rename

* fmt

* fix

* fmt
2024-05-04 18:16:28 +02:00
Dongjia "toka" Zhang
41ff7438eb
Fix incrementing found_objective(#2139) 2024-05-03 23:30:14 +02:00
Langston Barrett
382673b173
GenStage: A stage for generational (e.g., black-box) fuzzers (#2137)
* GenStage: A stage for generational (e.g., black-box) fuzzers

* mv stages/{gen,generation}.rs

* Fix doc link

* `GenStage`: Alphabetize type parameters

* Fighting rustdoc
2024-05-03 19:18:14 +02:00
Dongjia "toka" Zhang
f75c5ff4d3
Add found_objectives metadata (#2093)
* try

* add stuff

* clp

* Move to counter, remove penalization

* fix

* even milder

* fix

* clp

* no score

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
2024-05-03 16:37:05 +02:00
3453d02b1d fix fuzzing loop returning nothing 2024-05-03 13:28:49 +02:00
d93ed809f1 improve stg parsing 2024-05-03 13:28:15 +02:00
Valentin Huber
7fe0c576db
Make CommandExecutor Generic on the specific Input (#2129) 2024-05-02 15:39:06 -04:00
Dongjia "toka" Zhang
2e81dc6c59
Fix DDFuzz instrumentation (#2134) 2024-05-02 20:00:51 +02:00
Romain Malmain
02ef0c4dda
fix qemu systemmode fuzzers exit code (#2133) 2024-05-02 16:27:07 +02:00
Stefan Zabka
ec944a0ea4
Allow setting stdout_file in non-fork launcher (#2127)
* fix(launcher.rs): hide file output behind appropriate feature flag

discovered while debugging #2111

* fix(launcher.rs): implement stdout/stderr piping for non-forking unix

* hide all accesses to stdout_file in cfg blocks

* Conditionally add stdout_file config in frida_gdiplus
2024-05-02 10:24:36 -04:00
Romain Malmain
2302f1b35c
Fix QEMU doc not building (again) (#2130)
* fix doc not building.
2024-05-02 15:17:35 +02:00
Dongjia "toka" Zhang
359e94ec97
ctrl c handler fix for non-fork mode (#2132)
* poc

* ai suggestion

* rename this

* aaaa

* fmt

* simplify

* delete blob

* ignore

* fixup?

* some progress on cow-ification

* some more

* clippy fixes, finalise tests

* whoops, missed a spot

* no std compat

* api change: Named now requires alloc feature

* doc fix

* missed a spot

* additional fixes

* libfuzzer fixes

* fix tutorial

* fix

* add

* aa

* fix tutorial

* fix

* Rename

* fix

* aa

* fmt

* aa

* aa

* another closure

* clp

* fix stuff

* fix non fork

* fmt

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-05-02 14:43:25 +02:00
cube0x8
c79cdc89ac
add mmap hooks to libqasan (#2122)
* add mmap hooks to libqasan

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-05-02 10:39:33 +02:00
Romain Malmain
935100e7a7
Qemu update to latest version + various fixes (#2119)
* Fix maps iterator

* Added paranoid debug feature.

* Fix snapshot bugs.

* Update qemu-libafl-bridge.

* Added auto-generation of `x86_64_stub_bindings.rs` .

* Fix sync_exit calling to stopped CPU.
2024-05-02 09:31:54 +02:00
Dongjia "toka" Zhang
2f7c19e2b1
Change centralized launcher signature (#2094)
* poc

* ai suggestion

* rename this

* aaaa

* fmt

* simplify

* delete blob

* ignore

* fixup?

* some progress on cow-ification

* some more

* clippy fixes, finalise tests

* whoops, missed a spot

* no std compat

* api change: Named now requires alloc feature

* doc fix

* missed a spot

* additional fixes

* libfuzzer fixes

* fix tutorial

* fix

* add

* aa

* fix tutorial

* fix

* Rename

* fix

* aa

* fmt

* aa

* aa

* another closure

* clp

* fix stuff

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-30 19:44:57 +02:00
Dongjia "toka" Zhang
b23180394b
Fix Ctrl-C Handler (#2124)
* fix

* fix

* win

* win clp

* a

* FMT

* aaaaaaaaaaa

* aa

---------

Co-authored-by: Your Name <you@example.com>
2024-04-30 17:18:39 +02:00
clesmian
61ac4ea7be
Improve OnDiskTOMLMonitor (#2125)
* Allow for more frequent updates of TOML monitor

* Don't skip first client

* Reduce code duplication

* Immediately write first TOML file

* Rust fmt

* Use same client numbering as other monitors

* Fmt
2024-04-30 09:05:33 -04:00
Gregory Petrosyan
b49ab999e3
libafl_bolts: rands super mega ultra giga house cleaning of doom (#2123)
* rands: simpler rand_trait code, remove useless test

* rands: provide and use proper random_seed()

* rands: add missing golden tests

* Don't use current_nanos() for seeding

* rands: remove RandomSeed trait
2024-04-29 11:00:44 -04:00
Dongjia "toka" Zhang
50f14d44fa
Restrict more on edges map API (#2117)
* fix

* fix

* feature guard

* use

* cannnot find

* fmt

* more

* fix

* fix

* more

* fucking fmt just shut

* rename and change stuff

* fix

* fix

* fixxxxxxxxxx
2024-04-29 16:28:40 +02:00
Langston Barrett
b0248461e2
Allow for AsIter(Mut)/AsSlice(Mut) to be implemented in safe Rust (#2120)
* Generalize `AsIter` to allow iterating over contents of a `RefCell`

Towards `MapObserver`s in safe Rust.

* Helpers for `RefCellValueObserver`

* MapObserver: Return owned Self::Entry from .get()

`Self::Entry` is `Copy`, so there's not much value in returning a
reference from `get()`. Futhermore, returning a reference limits the
possible implementations of `MapObserver`, because it forces the
borrow/reset to outlive the body of the method.

* MapObserver: Replace `.get_mut()` with `.set(idx, val)`

Like the previous commit, this is intended to expand the possible
implementations of `MapObserver` to types with interior mutability,
which can't necessarily loan out their content.

* Make `RefCellValueObserver` into a safe `MapObserver`

* as iter mut

* as slice (mut): allow for non-& refs

* nostd

* CI round 1

* cleanup + AsSlice defs for RefCellValueObserver

* clippy fixes

* avoid unnecessary imports

* whoops, too aggressive

* use deref instead of as slice

* whoops

* fix as slice conditional importing in stable

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-27 18:36:56 +02:00
Addison Crump
28c43b332f
Match by Ref fix (#2105)
* match by ref fix

* impl Named for Reference

* rename

* magic indexing

* whoops

* docs, clippy

* some additional CI complaints

* other libafl_qemu fixes

* missed an alloc feature

* a smattering of fixes

* use from not direct construction

* tinyinst fix

* horrible double-mutability things

* fixup nyx

* from not new

* forkserver_simple fixes

* dogfood: forkserver

* mmmm yummy dogfood

* round one CI fixes

* clippy appeasement

* deref generic impl to simplify usage

* adaptive serialization (ouch)

* remaining clippy items

* I am tired

* new not with

* fixup: aflpp tracing was not actually constructable

* fix tmin

* reduce complexity of map feedback now that we do not need to constrain

* frida fixes

* fix concolic

* type_ref => reference
2024-04-27 18:08:09 +02:00
Dongjia "toka" Zhang
084b9b5878
Batch timeout fix (#2109)
* fix

* FMT

* unused
2024-04-26 17:10:36 +02:00
Aarnav
32963be453
add crash_exitcode to Forkserver to accomodate AFL_CRASH_EXITCODE (#2107)
* add crash_exitcode to Forkserver to accomodate AFL_CRASH_EXITCODE

* make crash_exitcode i8

---------

Co-authored-by: aarnav <aarnav@srlabs.de>
2024-04-26 16:24:25 +02:00
Addison Crump
c2e0e8ddbe
Add recv_blocking_with_flags (#2102)
* add recv_blocking_with_flags

* rollback, whoops
2024-04-26 16:22:32 +02:00
Dongjia "toka" Zhang
abcb2bf33e
Remove jobs dependency in CI (#2108) 2024-04-25 16:07:38 +02:00
Addison Crump
4c95d9029a
Split android and ios tests (#2106)
* split android and ios tests

* whoops
2024-04-25 12:23:46 +02:00
Romain Malmain
dd0fbff819
Small refactoring of libafl_qemu structure (#2098)
* Architecture-specific stuff is now in the `arch` directory

* Helpers are now in the `helpers` directory

* `emu.rs` has been moved as `emu/mod.rs` for consistency with the rest of the repository
2024-04-24 21:47:29 +02:00
Dongjia "toka" Zhang
c622a28eba
Rename from ReReference to Reference (#2099) 2024-04-24 15:06:33 +02:00
Gregory Petrosyan
1e8667a9f9
libafl_bolts: more rands improvements (#2096)
* rands: add missing inline directives

See:
- https://nnethercote.github.io/perf-book/inlining.html
- https://users.rust-lang.org/t/enable-cross-crate-inlining-without-suggesting-inlining/55004/6

* rands: better fast_bound() signature
2024-04-24 14:01:37 +02:00
Stefan Zabka
0f42efa12b
refactor(snapshot.rs): use const generics (#2069)
* refactor(snapshot.rs): use const generics

* Add docs to read hooks

---------

Co-authored-by: Romain Malmain <romain.malmain@pm.me>
2024-04-24 11:58:46 +02:00
Dongjia "toka" Zhang
176659821a
Add TypeRefCreator trait (#2065)
* poc

* ai suggestion

* rename this

* aaaa

* fmt

* simplify

* delete blob

* ignore

* fixup?

* some progress on cow-ification

* some more

* clippy fixes, finalise tests

* whoops, missed a spot

* no std compat

* api change: Named now requires alloc feature

* doc fix

* missed a spot

* additional fixes

* libfuzzer fixes

* fix tutorial

* fix

* add

* aa

* fix tutorial

* fix

* Rename

* fix

* aa

* fmt

* aa

---------

Co-authored-by: Addison Crump <addison.crump@cispa.de>
2024-04-23 19:03:30 +02:00
6774a778c3 add wip stg tracer 2024-04-23 16:53:55 +02:00
Aarnav
76a95bc5fd
Introduce AFL_EXIT_ON_SEED_ISSUES (#2085)
* introduce load_initial_inputs_disallow_solution to exit if a solution is found during seed loading

* fmt

* rename CorpusError to Corpus

* add LoadConfig to simplify configuration for loading initial inputs

* Rename Error::Corpus to Error::InvalidCorpus
Add documentation to LoadConfig struct
fix nostd for LoadConfig

---------

Co-authored-by: aarnav <aarnav@srlabs.de>
2024-04-23 15:53:18 +02:00
Josef Haider
d34965192d
Add FeedbackFactory implementations for CrashFeedback, CombinedFeedback and DiffFeedback. (#2060)
* Add FeedbackFactory implementations for CrashFeedback, CombinedFeedback and DiffFeedback

* remove redundant type CrashFeedbackFactory
2024-04-23 15:48:52 +02:00
Gregory Petrosyan
e1b8c9b5d8
libafl_bolts: improvements to the rands module, add next_float (#2086)
* rands: use splitmix64 for seeding

Seeding with splitmix64 is a good way to avoid starting with
low-entropy PRNG states, and is explicitly recommended
by the authors of both xoshiro256++ and Romu.

While at it, give the xoshiro256++ PRNG its proper name.

* rands: use fast_bound() to generate number in range

* rands: add top-level choose()

* rands: add Rand::next_float()

* rands: add Rand::coinflip() helper

* libafl: unbreak tests that relied on direct seeding

* rands: add SFC64 PRNG

SFC64 is a well-established and well-understood PRNG designed by
Chris Doty-Humphrey, the author of PractRand. It has been tested
quite a lot over the years, and to date has no known weaknesses.

Compared to xoshiro256++, it is slightly faster and is likely to
be a more future-proof design (xoshiro/xoroshiro family of generators
come with quite long history of [flaws][1] found over the years).

Compared to Romu, it is slightly slower, but guarantees absense
of bias, minimum period of at least 2^64 for any seed, and
non-overlapping streams for different seeds.

[1]: https://tom-kaitchuck.medium.com/designing-a-new-prng-1c4ffd27124d
2024-04-23 15:37:28 +02:00
Dongjia "toka" Zhang
5ff709f241
Symcc Update (#2047)
* symcc upd

* upda

* fix

* fmt

* mm

* psu

* psh

* fix

* fix

* fix

* tmate

* can't make it work

* i really hate you llvm

* real name

* mm
2024-04-23 13:34:46 +02:00
Romain Malmain
2046cfe82d
Checkout before filter (#2092) 2024-04-23 09:45:45 +02:00
Dongjia "toka" Zhang
ea6a36b0a5
fix (#2091) 2024-04-22 21:55:55 +02:00
Dongjia "toka" Zhang
0f3ad288e7
Fix #1932 (#2089)
* fix

* Stupid lint

* increase rate

* fix
2024-04-22 19:27:13 +02:00
Romain Malmain
98863fbff5
Only run QEMU tests if there is a QEMU-related change. (#2090)
* Only run QEMU tests if there is a change.

* fmt.
2024-04-22 19:14:23 +02:00
Romain Malmain
fef6c8d1b1
Run qemu_systemmode tests with self-hosted runners (#2018)
* run qemu fuzzers (qemu_systemmode only for now) in self-hosted runners

* Remove qemu-related fuzzers to general fuzzers

* fix

* Install dependencies before anything else

* Do not use sudo

* Install sudo

* Revert "Install dependencies before anything else"

This reverts commit 107addad5d9f68dec5a9af50831112cd72c28f4d.

* added qemu specific prerequisites

* add -y flag

* Format with nightly

* Do not use nightly only.
Install fmt and clippy for stable as well.

* Install qemu-img for qemu

* fix qemu-img install

* apt update

* Changed timeout.

* Fix qemu_systemmode test

* fmt

* clippy + decorrelate build and run for qemu_systemmode.

* fix fuzzer

* clippy

* add sqlite3-dev to package prerequisites.

* add arm-none-eabi-gcc

* fix profile dir

* fix condition.

* Run less QEMU stuff faster

---------

Co-authored-by: Toka <tokazerkje@outlook.com>
2024-04-22 18:17:22 +02:00
Tobias Mayer
fe64d10a5c
Fix typo in setup_libxml2.sh (#2088)
exit for a non-zero exit code
2024-04-22 14:37:41 +02:00
Dongjia "toka" Zhang
2df71e7a36
Faster cargo check (#2084)
* speed up cargo check

* fix

* composite

* plural

* wrong name

* go brrrrrrrr

* bash

* aaaaa

* why not even more?

* more composite

* fix

* miri

* test for llvm >= 16

* v2

* v2

* naaaa

* JUST MORE INSTANCES

* aa

* fix

* no bash for windows

* reduce a bit as some guys are delayed

* no deps
2024-04-20 10:50:43 +02:00
Addison Crump
fd364d15fe
cargo-fuzz testing (#2081)
* Build cargo-fuzz end to end

* Workaroudn failing CI

* Fix toml

* Build

* Exclude from workspace

* Fix version

* Fix workspace

* Fix workspace

* FIx workspace

* Fix path

* Set path correctly

* Install llvm-tools

* Test with distro llvm installed

* Use build

* complete

* remove from includes

* add back fuzzer tests, format

* add test for whether all fuzzers are actually tested in pipeline

* whoops

* I hate CI I hate CI I hate CI

* revert removal of llvm

* sh compatibility

* sigh

---------

Co-authored-by: Max Ammann <max@maxammann.org>
2024-04-19 23:55:28 +02:00
Dongjia "toka" Zhang
ea549b9cfe
Add a warning to say never use EDGES_MAP.len() (#2083)
* Revert "Revert splitting libafl_edges_map_max and libafl_edges_map_in_use (#2…"

This reverts commit c68b3816fb680b635f99c337f78185e699864705.

* all

* more

* add

* add
2024-04-19 23:26:00 +02:00